CVE-2026-58138-Conductor-Unauth-RCE

CVE-2026-58138 — Conductor (3.21.21..<3.30.2) unauthenticated RCE via INLINE GraalVM evaluator (HostAccess.ALL). Lab + PoC, verified e2e (root).

Version note (read this). The evaluator config varies inside the affected range: versions through ~3.29.x (this lab uses 3.22.3) build the context with plain allowHostAccess(HostAccess.ALL) — the unsandboxed config the CVE describes, and the one this PoC exploits directly. The 3.30.0/3.30.1 line added a partial denyAccess(...) blocklist (reflection blocked); the complete fix (allowHostClassLoading(false) + engine hardening) only lands in 3.30.2. This PoC targets the plain-HostAccess.ALL configuration; it does not claim to bypass the 3.30.1 blocklist.

Root cause

core/.../events/ScriptEvaluator.java (≤ 3.29.x / 3.22.3):

HostAccess.ALL lets the script call any method/field on Java host objects. The INLINE task binds its input as $, a real Java object, so the script can pivot: $.getClass().getClass() → java.lang.Class → Class.forName("java.lang.Runtime") → Runtime.getRuntime().exec(...). The Python evaluator is equivalent (Context.newBuilder("python").allowAllAccess(true)).

Exploitation

1. Register a workflow whose INLINE task carries the malicious expression (POST /api/metadata/workflow, no auth).
2. Start it (POST /api/workflow/{name}, no auth).
3. The INLINE task evaluates the JS; the reflective Runtime.exec runs the command and the PoC returns its stdout as the task result.

Reproduce

Observed:

uid=0(root) is the Conductor process user; the output is live id/uname state — genuine execution, not echo. exploit.py uses only the Python standard library.

Impact

Anyone able to reach the Conductor API executes arbitrary OS commands (here as root) on the orchestrator host — full compromise of the workflow engine, its persistence/queues, and every system its workflows and stored credentials touch.

Remediation

• Upgrade to Conductor ≥ 3.30.2 (the JS/Python evaluators no longer run with host access / class loading enabled).
• Defense in depth: put authentication in front of the Conductor API, run the server as a non-root, least-privilege user, and restrict who can register/run workflows.

Detection

Flag workflow definitions whose INLINE/LAMBDA/DO_WHILE/SWITCH tasks contain expression strings referencing getClass, forName, Runtime, exec, ProcessBuilder, or java. reflection, and Conductor processes spawning shells.

See ANALYSIS.md for the reflection chain, the evaluator config across versions, and the patch.

• Author: Caio Fabrício — github.com/BiiTts
• Vulnerability credit belongs to the original reporter / vendor advisory; this repo is an independent, reproducible lab + PoC for defensive and educational use. For authorized security testing only.